Scribd Logo
Upload

Welcome to Scribd!

  • 127 views

    GTP Attack Types

    Uploaded by

    borisyil
    This document outlines several types of GTP attacks that could compromise an IPX/GRX infrastructure. These include eavesdropping on GTP traffic to gain subscriber information, generating malicious GTP messages to cause denial of service or subscriber session damage, flooding networks with messages to exhaust IP addresses, and actively suppressing or modifying messages to cause denial of service or keep sessions active.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    GTP Attack Types

    Uploaded by

    borisyil
    127 views5 pages
    This document outlines several types of GTP attacks that could compromise an IPX/GRX infrastructure. These include eavesdropping on GTP traffic to gain subscriber information, generating malicious GTP messages to cause denial of service or subscriber session damage, flooding networks with messages to exhaust IP addresses, and actively suppressing or modifying messages to cause denial of service or keep sessions active.

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document outlines several types of GTP attacks that could compromise an IPX/GRX infrastructure. These include eavesdropping on GTP traffic to gain subscriber information, generating malicious GTP messages to cause denial of service or subscriber session damage, flooding networks with messages to exhaust IP addresses, and actively suppressing or modifying messages to cause denial of service or keep sessions active.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    127 views5 pages

    GTP Attack Types

    Uploaded by

    borisyil
    This document outlines several types of GTP attacks that could compromise an IPX/GRX infrastructure. These include eavesdropping on GTP traffic to gain subscriber information, generating malicious GTP messages to cause denial of service or subscriber session damage, flooding networks with messages to exhaust IP addresses, and actively suppressing or modifying messages to cause denial of service or keep sessions active.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    You are on page 1of 5

    GTP Attack Types

    GTP eavesdropping

    If an IPX/GRX infrastructure is compromised, a potential attacker can snoop into passing


    GTP traffic and gain valuable subscriber information. For example, User Location
    information can be exposed if ‘MS Info Change Notification' Requests are sent between
    Visited PMN and Home PMN.

    Other important information that can be exposed to the attacker is subscriber APN
    credentials. Those credentials are transmitted in clear-text and are part of PPP set-up
    procedure.
    Generation of malicious GTP messages

    Besides just parsing the transiting GTP traffic, an attacker can generate malicious
    requests and cause significant damage to subscriber sessions, billing and Denial of
    Service on a specific SGW(s). Vectors of potential attacks include but are not limited to:

    - DoS attack on all subscribers served by the same SGW is made possible through
    generation of GTP messages containing increased Recovery information element (IE)

    - Information gathering through sending fake ‘Delete Session Request’ which must be
    answered by receiving NE

    - Unauthorized access to an APN by impersonating a Visited PLMN SGW and sending a


    message to Home PLMN PGW with Selection Mode IE set to ‘Verified’ i.e. indicating that
    HLR has approved the access of this UE to the specified APN

    - Billing fraud and impersonation of another subscriber by specifying another


    subscriber’s IMSI in Session Setup Request

    - Redirect existing GTP-U tunnel to another PGW by sending Update PDP Context
    Request message and specifying new TEID Data

    - DoS attack on all subscribers served by the same SGW board by sending Delete PDN
    Connection Set Request with a valid FQ-CSID
    Flood of malicious GTP messages

    One of the serious concerns of any MNO is the potential network outage and service
    degradation due to an exhaustion of IP addresses assigned to a particular PGW, and this
    vulnerability can be exploited by sending a flood of ‘Create Session Request’ messages
    to that PGW
    Active message suppression

    Message suppression and dropping poses a risk for subscribers as it can cause legitimate ‘Delete
    Session Request’ messages to never reach Home PGW, keeping subscriber’s PDP context active
    in VPLMN.

    Active message suppression and modification

    As with active suppression, an attacker can modify or drop and recreate GTP requests and/or
    answers. As a possible attack vector, a legitimate ‘Session Setup Response’/‘Create Session
    Response’ is modified to include a ‘Cause’ IE value other than “Request Accepted”, “New PDP
    type due to network preference” or “New PDP type due to single address bearer only". This
    behavior causes Denial of Service for affected subscribers.

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy